@cat-factory/app 0.49.1 → 0.50.0

package/app/components/settings/ProviderConnectionTab.vue

@@ -11,6 +11,7 @@ import type { ProviderConnectionKind } from '~/types/providerConnections'
 import ProvisioningLogsDrawer from '~/components/provisioning/ProvisioningLogsDrawer.vue'
 import ProviderManifestEditor from '~/components/settings/ProviderManifestEditor.vue'
 import KubernetesRunnerForm from '~/components/settings/KubernetesRunnerForm.vue'
+import KubernetesEnvironmentForm from '~/components/settings/KubernetesEnvironmentForm.vue'
 
 const props = defineProps<{ kind: ProviderConnectionKind }>()
 
@@ -185,18 +186,32 @@ async function saveManifest(payload: {
   }
 }
 
-// --- Runner-backend selector (runner-pool only) -------------------------------------
-// The runner-pool tab can configure either the manifest pool OR a native Kubernetes
-// cluster; environments are manifest-only. Defaults to the saved connection's kind.
-const RUNNER_BACKEND_KINDS = ['manifest', 'kubernetes'] as const
-type RunnerBackendKind = (typeof RUNNER_BACKEND_KINDS)[number]
-const backendKind = ref<RunnerBackendKind>('manifest')
-const showBackendSelector = computed(() => props.kind === 'runner-pool')
+// --- Backend selector -----------------------------------------------------------------
+// Both infrastructure tabs can configure either the BYO manifest backend OR a native
+// Kubernetes backend (a runner cluster for runner-pool, per-PR namespaces for environment).
+// The two K8s backends have different config shapes, so each kind renders its own form.
+// Defaults to the saved connection's kind.
+const BACKEND_KINDS = ['manifest', 'kubernetes'] as const
+type BackendKind = (typeof BACKEND_KINDS)[number]
+const backendKind = ref<BackendKind>('manifest')
+const showBackendSelector = computed(() => true)
+const backendSelectorLabel = computed(() =>
+  t(
+    props.kind === 'environment'
+      ? 'settings.providerConnection.backend.environmentSelectorLabel'
+      : 'settings.providerConnection.backend.selectorLabel',
+  ),
+)
+function backendKindLabel(k: BackendKind): string {
+  if (k === 'kubernetes') return t('settings.providerConnection.backend.kubernetes')
+  return t(
+    props.kind === 'environment'
+      ? 'settings.providerConnection.backend.environmentManifest'
+      : 'settings.providerConnection.backend.manifest',
+  )
+}
 const backendKindItems = computed(() =>
-  RUNNER_BACKEND_KINDS.map((k) => ({
-    label: t(`settings.providerConnection.backend.${k}`),
-    value: k,
-  })),
+  BACKEND_KINDS.map((k) => ({ label: backendKindLabel(k), value: k })),
 )
 watch(
   () => connection.value,
@@ -317,17 +332,26 @@ function fieldHelp(key: string): string | undefined {
       }}
     </div>
 
-    <!-- Runner-backend selector: the manifest pool or a native Kubernetes cluster. -->
-    <UFormField
-      v-if="showBackendSelector"
-      :label="t('settings.providerConnection.backend.selectorLabel')"
-    >
+    <!-- Backend selector: the BYO manifest backend or a native Kubernetes backend. -->
+    <UFormField v-if="showBackendSelector" :label="backendSelectorLabel">
       <USelect v-model="backendKind" :items="backendKindItems" />
     </UFormField>
 
-    <!-- Native Kubernetes runner backend. -->
+    <!-- Native Kubernetes runner backend (runner-pool). -->
     <KubernetesRunnerForm
-      v-if="showBackendSelector && backendKind === 'kubernetes'"
+      v-if="kind === 'runner-pool' && backendKind === 'kubernetes'"
+      :connection="connection"
+      :supports-test="descriptor.supportsTest"
+      :testing="testing"
+      :busy="busy"
+      :test-result="testResult"
+      @test="testConfig"
+      @save="saveConfig"
+    />
+
+    <!-- Native Kubernetes ephemeral-environment backend (environment). -->
+    <KubernetesEnvironmentForm
+      v-else-if="kind === 'environment' && backendKind === 'kubernetes'"
       :connection="connection"
       :supports-test="descriptor.supportsTest"
       :testing="testing"
@@ -416,18 +440,31 @@ function fieldHelp(key: string): string | undefined {
       </div>
     </div>
 
-    <!-- MANIFEST-driven provider: the full in-app manifest editor. -->
-    <ProviderManifestEditor
+    <!-- MANIFEST-driven provider: the raw JSON manifest editor. Collapsed by default — it's
+         the advanced path, needed ONLY to integrate a custom API-based scheduler. The common
+         backends (local Docker, Cloudflare Containers, Kubernetes) don't need it. -->
+    <details
       v-else
-      :kind="kind"
-      :saved-manifest="descriptor.savedManifest"
-      :connected="!!connection"
-      :supports-test="descriptor.supportsTest"
-      :testing="testing"
-      :busy="busy"
-      :test-result="testResult"
-      @test="testManifest"
-      @save="saveManifest"
-    />
+      class="rounded-lg border border-slate-700 bg-slate-900/40 p-3"
+      :open="!!connection"
+    >
+      <summary class="cursor-pointer text-sm font-medium text-slate-200">
+        {{ t('settings.providerConnection.advancedManifest.summary') }}
+      </summary>
+      <p class="mt-2 mb-3 text-[11px] text-slate-400">
+        {{ t('settings.providerConnection.advancedManifest.intro') }}
+      </p>
+      <ProviderManifestEditor
+        :kind="kind"
+        :saved-manifest="descriptor.savedManifest"
+        :connected="!!connection"
+        :supports-test="descriptor.supportsTest"
+        :testing="testing"
+        :busy="busy"
+        :test-result="testResult"
+        @test="testManifest"
+        @save="saveManifest"
+      />
+    </details>
   </div>
 </template>

package/app/composables/api/providerConnections.ts

@@ -70,12 +70,15 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
       kind === 'environment'
         ? send(CONTRACTS.environment.register, {
             pathPrefix: ws(workspaceId),
-            body: body as RegisterEnvironmentProviderInput,
+            body: {
+              config: backendConfig(body),
+              secrets: body.secrets,
+            } as RegisterEnvironmentProviderInput,
           })
         : send(CONTRACTS['runner-pool'].register, {
             pathPrefix: ws(workspaceId),
             body: {
-              config: runnerBackendConfig(body),
+              config: backendConfig(body),
               secrets: body.secrets,
             } as RegisterRunnerPoolInput,
           }),
@@ -94,12 +97,15 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
       kind === 'environment'
         ? send(CONTRACTS.environment.test, {
             pathPrefix: ws(workspaceId),
-            body: body as TestEnvironmentConnectionInput,
+            body: {
+              ...(body.manifest || body.config ? { config: backendConfig(body) } : {}),
+              ...(body.secrets ? { secrets: body.secrets } : {}),
+            } as TestEnvironmentConnectionInput,
           })
         : send(CONTRACTS['runner-pool'].test, {
             pathPrefix: ws(workspaceId),
             body: {
-              ...(body.manifest || body.config ? { config: runnerBackendConfig(body) } : {}),
+              ...(body.manifest || body.config ? { config: backendConfig(body) } : {}),
               ...(body.secrets ? { secrets: body.secrets } : {}),
             } as TestRunnerPoolConnectionInput,
           }),
@@ -110,13 +116,12 @@ export function providerConnectionsApi({ send, ws }: ApiContext) {
 }
 
 /**
- * Resolve the discriminated runner-backend config from a connect-form payload: an
- * explicit `config` (the Kubernetes form) wins; otherwise a bare `manifest` (the manifest
- * editor) is wrapped into the manifest backend kind.
+ * Resolve the discriminated backend config (runner-pool OR environment) from a connect-form
+ * payload: an explicit `config` (the Kubernetes form) wins; otherwise a bare `manifest` (the
+ * manifest editor) is wrapped into the `manifest` backend kind. Both subsystems now take a
+ * discriminated `config`, so the same shape serves each.
  */
-function runnerBackendConfig(
-  body: RegisterProviderInput | TestProviderInput,
-): Record<string, unknown> {
+function backendConfig(body: RegisterProviderInput | TestProviderInput): Record<string, unknown> {
   if (body.config) return body.config
   return { kind: 'manifest', manifest: body.manifest ?? {} }
 }

package/app/pages/index.vue

@@ -79,9 +79,6 @@ const ModelConfigurationPanel = defineAsyncComponent(
 const LocalModelEndpointsPanel = defineAsyncComponent(
   () => import('~/components/settings/LocalModelEndpointsPanel.vue'),
 )
-const LocalModeSettingsPanel = defineAsyncComponent(
-  () => import('~/components/settings/LocalModeSettingsPanel.vue'),
-)
 const SandboxPanel = defineAsyncComponent(() => import('~/components/sandbox/SandboxPanel.vue'))
 const UserSecretsSection = defineAsyncComponent(
   () => import('~/components/settings/UserSecretsSection.vue'),
@@ -287,7 +284,6 @@ watch(
       <InfrastructureWindow v-if="ui.infrastructureOpen" />
       <ModelConfigurationPanel v-if="ui.modelConfigOpen" />
       <LocalModelEndpointsPanel v-if="ui.localModelsOpen" />
-      <LocalModeSettingsPanel v-if="ui.localModeSettingsOpen" />
       <SandboxPanel v-if="ui.sandboxOpen" />
       <UserSecretsSection v-if="ui.userSecretsOpen" />
       <OpenRouterCatalogPanel v-if="ui.openRouterOpen" />

package/app/stores/auth.ts

@@ -1,4 +1,4 @@
-import type { LocalModeConfig } from '@cat-factory/contracts'
+import type { InfrastructureCapabilities, LocalModeConfig } from '@cat-factory/contracts'
 import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
 import type { AuthUser } from '~/types/domain'
@@ -31,6 +31,13 @@ export const useAuthStore = defineStore(
      * setup banner). Null on every other facade.
      */
     const localMode = ref<LocalModeConfig | null>(null)
+    /**
+     * The deployment's infrastructure execution backends (which agent-container runtime + test
+     * environment options exist, and the deployment default active one). Drives the
+     * Infrastructure window's backend selector. Null until the auth handshake resolves / on a
+     * facade that doesn't report it.
+     */
+    const infrastructure = ref<InfrastructureCapabilities | null>(null)
     /**
      * Local mode only: the source-control provider the user last chose to sign in with
      * (its PAT lives server-side in env — this is just the non-secret choice). Persisted, so
@@ -72,6 +79,7 @@ export const useAuthStore = defineStore(
         required.value = config.enabled
         if (config.providers) providers.value = config.providers
         localMode.value = config.localMode ?? null
+        infrastructure.value = config.infrastructure ?? null
       } catch {
         // Backend unreachable — let the board's own error UI handle it.
         required.value = false
@@ -222,6 +230,7 @@ export const useAuthStore = defineStore(
       required,
       providers,
       localMode,
+      infrastructure,
       autoLoginProvider,
       ready,
       isAuthenticated,

package/app/stores/ui.ts

@@ -125,11 +125,12 @@ export const useUiStore = defineStore('ui', () => {
   // today, pluggable). NB: distinct from `observabilityInstanceId` below, which is the
   // LLM per-call observability panel.
   const observabilityConnectionOpen = ref(false)
-  // The single tabbed Infrastructure window (ephemeral-environment provider + self-hosted
-  // runner pool — the same custom pool typically backs both jobs, so they're configured
-  // together). `infrastructureOpen` is the modal flag; `infrastructureTab` selects which
-  // provider's tab is shown. `openProviderConnection(kind)` stays the entry API but now
-  // selects the matching tab instead of mounting a per-kind standalone panel.
+  // The single tabbed Infrastructure window — a TOP-LEVEL navbar destination (no longer
+  // reached via the Integrations hub). Two topical tabs: "Agent containers" (the execution
+  // backend + self-hosted runner pool, plus the local-mode warm pool/checkout) and "Test
+  // environments" (the ephemeral-environment provider). `infrastructureOpen` is the modal
+  // flag; `infrastructureTab` selects the tab. `openInfrastructure()` is the navbar entry;
+  // `openProviderConnection(kind)` remains for deep-links (a banner's "Configure…" button).
   const infrastructureOpen = ref(false)
   const infrastructureTab = ref<'environment' | 'runner-pool'>('runner-pool')
   const modelConfigOpen = ref(false)
@@ -140,9 +141,6 @@ export const useUiStore = defineStore('ui', () => {
   const vendorCredentialsTab = ref('pool')
   // Per-user settings panel: the signed-in user's own-machine local model runners.
   const localModelsOpen = ref(false)
-  // Local-mode-only settings panel: the warm-container pool sizing + per-repo checkout reuse
-  // (a per-deployment singleton that replaced the LOCAL_POOL_* / HARNESS_* env vars).
-  const localModeSettingsOpen = ref(false)
   // The Sandbox (parallel prompt/model testing) surface — an opt-in, on-demand window.
   const sandboxOpen = ref(false)
   const userSecretsOpen = ref(false)
@@ -479,6 +477,13 @@ export const useUiStore = defineStore('ui', () => {
   function closeObservabilityConnection() {
     observabilityConnectionOpen.value = false
   }
+  // Top-level navbar entry into the Infrastructure window. No hub-return marker (it isn't
+  // reached from the Integrations hub), so the window shows no "Back to Integrations" control.
+  function openInfrastructure(tab: 'environment' | 'runner-pool' = 'runner-pool') {
+    resetHubReturn()
+    infrastructureTab.value = tab
+    infrastructureOpen.value = true
+  }
   function openProviderConnection(kind: 'environment' | 'runner-pool') {
     resetHubReturn()
     infrastructureTab.value = kind
@@ -511,13 +516,6 @@ export const useUiStore = defineStore('ui', () => {
   function closeLocalModels() {
     localModelsOpen.value = false
   }
-  function openLocalModeSettings() {
-    resetHubReturn()
-    localModeSettingsOpen.value = true
-  }
-  function closeLocalModeSettings() {
-    localModeSettingsOpen.value = false
-  }
   function openSandbox() {
     sandboxOpen.value = true
   }
@@ -669,11 +667,11 @@ export const useUiStore = defineStore('ui', () => {
     observabilityConnectionOpen,
     infrastructureOpen,
     infrastructureTab,
+    openInfrastructure,
     modelConfigOpen,
     vendorCredentialsOpen,
     vendorCredentialsTab,
     localModelsOpen,
-    localModeSettingsOpen,
     sandboxOpen,
     userSecretsOpen,
     openRouterOpen,
@@ -754,8 +752,6 @@ export const useUiStore = defineStore('ui', () => {
     closeVendorCredentials,
     openLocalModels,
     closeLocalModels,
-    openLocalModeSettings,
-    closeLocalModeSettings,
     openSandbox,
     closeSandbox,
     openUserSecrets,

package/i18n/locales/en.json

@@ -33,6 +33,7 @@
     "addFromRepo": "Add from existing repo",
     "bootstrapRepo": "Bootstrap repo",
     "integrations": "Integrations",
+    "infrastructure": "Infrastructure",
     "sandbox": "Sandbox",
     "@sandbox": {
       "description": "Named feature area (a screen for trying prompt versions / models against graded fixtures). Fine to localize descriptively per locale - unlike nav.kaizen, this one is NOT kept verbatim."
@@ -1150,7 +1151,6 @@
         "documents": "Documents",
         "taskTrackers": "Task trackers",
         "observability": "Observability",
-        "infrastructure": "Infrastructure",
         "personal": "Personal (only you)"
       },
       "items": {
@@ -1188,16 +1188,6 @@
           "label": "Post-release health",
           "description": "Watch monitors and SLOs after a release ships (Datadog)."
         },
-        "infrastructure": {
-          "label": "Infrastructure",
-          "description": "Self-hosted runner pool for container agents and ephemeral test environments.",
-          "agents": "Agents: {state}",
-          "envs": "Envs: {state}"
-        },
-        "localMode": {
-          "label": "Local mode",
-          "description": "Warm container pool plus per-repo checkout reuse for the local runner."
-        },
         "githubPat": {
           "label": "My GitHub token",
           "description": "A personal access token used for runs you start (pushes, PRs, CI, merge)."
@@ -1259,12 +1249,28 @@
         "fragments": "Context fragments"
       }
     },
+    "infrastructure": {
+      "active": "Active: {backend}",
+      "registerHint": "Register a runner pool below to enable this.",
+      "updateFailed": "Could not update the execution backend",
+      "executionBackend": {
+        "label": "Where agents run",
+        "local-docker": "Local Docker (host)",
+        "cloudflare-containers": "Cloudflare Containers (built-in)",
+        "runner-pool": "Self-hosted runner pool"
+      },
+      "testEnvBackend": {
+        "label": "Where test environments run",
+        "local-compose": "In-container docker-compose",
+        "environment-provider": "Environment provider"
+      }
+    },
     "providerConnection": {
       "fallbackTitle": "Provider",
       "windowTitle": "Infrastructure",
       "noneAvailable": "No infrastructure providers are enabled on this deployment.",
       "tabs": {
-        "containerAgents": "Container agents",
+        "agentContainers": "Agent containers",
         "testEnvironments": "Test environments"
       },
       "kind": {
@@ -1280,7 +1286,46 @@
       "backend": {
         "selectorLabel": "Runner backend",
         "manifest": "Self-hosted pool (manifest)",
-        "kubernetes": "Kubernetes"
+        "kubernetes": "Kubernetes",
+        "environmentSelectorLabel": "Environment backend",
+        "environmentManifest": "Custom HTTP API (manifest)"
+      },
+      "kubernetesEnv": {
+        "label": "Name",
+        "labelPlaceholder": "Preview cluster",
+        "apiServerUrl": "API server URL",
+        "apiServerUrlHelp": "The kube-apiserver root, e.g. https://10.0.0.1:6443. The orchestrator applies each PR's manifests through the apiserver, so only this endpoint must be reachable.",
+        "apiToken": "ServiceAccount token",
+        "apiTokenHelp": "A bearer token with RBAC to create namespaces and apply the operator's resources. Stored encrypted; never shown again.",
+        "manifestSourceLabel": "Manifest source",
+        "sourceColocated": "Co-located in the PR repo",
+        "sourceSeparate": "Separate repo",
+        "repo": "Manifests repo",
+        "repoHelp": "The owner/repo that holds the Kubernetes manifests, e.g. acme/preview-manifests.",
+        "ref": "Ref",
+        "refHelp": "Branch, tag or SHA to read the manifests at. Empty uses the repo's default branch.",
+        "path": "Manifest path",
+        "pathHelp": "File or directory within the repo holding the resources to apply.",
+        "urlSourceLabel": "Environment URL",
+        "urlIngressTemplate": "Ingress host template",
+        "urlIngressStatus": "Read Ingress status",
+        "urlServiceStatus": "Read Service status",
+        "hostTemplate": "Host template",
+        "hostTemplateHelp": "Host template rendered with the provision vars such as branch and pullNumber; the rendered host becomes the environment URL.",
+        "ingressName": "Ingress name",
+        "ingressNameHelp": "Ingress to read the load-balancer host from. Empty uses the only Ingress applied.",
+        "serviceName": "Service name",
+        "port": "Port",
+        "scheme": "URL scheme",
+        "schemeDefault": "https (default)",
+        "namespaceTemplate": "Namespace template",
+        "namespaceTemplateHelp": "Per-PR namespace name rendered from the provision vars such as pullNumber. Empty derives one from the PR number.",
+        "imageTemplate": "Image template",
+        "imageTemplateHelp": "Image reference exposed to the manifests, rendered over the provision vars such as branch and sha.",
+        "caCertPem": "Cluster CA certificate (PEM)",
+        "caCertPemHelp": "Paste the cluster CA bundle so the apiserver's TLS certificate verifies. Omit only for a publicly-trusted CA.",
+        "insecureSkipTlsVerify": "Skip TLS verification",
+        "insecureSkipTlsVerifyHelp": "Strongly discouraged. Disables apiserver TLS verification; use only for kind/dev clusters."
       },
       "kubernetes": {
         "label": "Name",
@@ -1309,16 +1354,9 @@
         "reenterSecrets": "Re-enter every secret to save. Stored secrets are write-only and aren't shown.",
         "starterHint": "This is a starter example. Edit it to match your provider's API."
       },
-      "delegation": {
-        "title": "Local delegation",
-        "intro": "By default this machine runs everything locally — container agents on host Docker, the Tester's infrastructure via in-container docker-compose. Opt in below to delegate either concern to an external service instead. Applies only in local mode.",
-        "agentsToggle": "Run container agents on the runner pool",
-        "agentsHint": "Dispatch every container agent (coder, tester, merger, bootstrap, …) to this workspace's self-hosted runner pool instead of host Docker.",
-        "registerPoolPrompt": "{link} first to enable this.",
-        "registerPoolLink": "Register a runner pool",
-        "envToggle": "Provision Tester environments via the provider",
-        "envHint": "Stand the Tester's preview environment up through the environment provider configured below instead of in-container docker-compose. Connect a provider first to enable this.",
-        "updateFailed": "Could not update delegation"
+      "advancedManifest": {
+        "summary": "Advanced: custom API-based scheduler",
+        "intro": "Only needed to integrate a custom API-based scheduler. The common backends (local Docker, Cloudflare Containers and Kubernetes) don't need this; describe your own scheduler's HTTP API here only if you run one."
       },
       "viewLogs": "View logs",
       "hideLogs": "Hide logs",

package/i18n/locales/es.json

@@ -34,7 +34,8 @@
     "configuration": "Configuración",
     "workspaceSettings": "Ajustes del espacio de trabajo",
     "modelConfiguration": "Configuración del modelo",
-    "accountSettings": "Ajustes de la cuenta"
+    "accountSettings": "Ajustes de la cuenta",
+    "infrastructure": "Infraestructura"
   },
   "board": {
     "toolbar": {
@@ -1111,7 +1112,6 @@
         "documents": "Documentos",
         "taskTrackers": "Rastreadores de tareas",
         "observability": "Observabilidad",
-        "infrastructure": "Infraestructura",
         "personal": "Personal (solo tú)"
       },
       "items": {
@@ -1149,16 +1149,6 @@
           "label": "Salud posterior al lanzamiento",
           "description": "Vigila los monitores y SLO después de publicar una versión (Datadog)."
         },
-        "infrastructure": {
-          "label": "Infraestructura",
-          "description": "Grupo de ejecutores autoalojado para los agentes de contenedor y entornos de prueba efímeros.",
-          "agents": "Agentes: {state}",
-          "envs": "Entornos: {state}"
-        },
-        "localMode": {
-          "label": "Modo local",
-          "description": "Grupo de contenedores en caliente y reutilización de checkout por repositorio para el ejecutor local."
-        },
         "githubPat": {
           "label": "Mi token de GitHub",
           "description": "Un token de acceso personal usado para las ejecuciones que inicias (pushes, PR, CI, fusión)."
@@ -1225,8 +1215,8 @@
       "windowTitle": "Infraestructura",
       "noneAvailable": "No hay proveedores de infraestructura habilitados en este despliegue.",
       "tabs": {
-        "containerAgents": "Agentes de contenedor",
-        "testEnvironments": "Entornos de prueba"
+        "testEnvironments": "Entornos de prueba",
+        "agentContainers": "Agentes de contenedor"
       },
       "kind": {
         "environment": {
@@ -1250,17 +1240,6 @@
         "reenterSecrets": "Vuelve a introducir cada secreto para guardar: los secretos almacenados son de solo escritura y no se muestran.",
         "starterHint": "Este es un ejemplo inicial. Edítalo para que coincida con la API de tu proveedor."
       },
-      "delegation": {
-        "title": "Delegación local",
-        "intro": "De forma predeterminada, esta máquina ejecuta todo localmente: los agentes de contenedor en Docker del host y la infraestructura del Tester mediante docker-compose dentro del contenedor. Activa las opciones de abajo para delegar cualquiera de estas tareas en un servicio externo. Solo se aplica en modo local.",
-        "agentsToggle": "Ejecutar los agentes de contenedor en el grupo de ejecutores",
-        "agentsHint": "Envía cada agente de contenedor (codificador, tester, fusionador, bootstrap, …) al grupo de ejecutores autoalojado de este espacio de trabajo en lugar de a Docker del host.",
-        "registerPoolPrompt": "{link} primero para habilitar esto.",
-        "registerPoolLink": "Registra un grupo de ejecutores",
-        "envToggle": "Aprovisionar los entornos del Tester mediante el proveedor",
-        "envHint": "Levanta el entorno de vista previa del Tester a través del proveedor de entornos configurado abajo en lugar de docker-compose dentro del contenedor. Conecta un proveedor primero para habilitar esto.",
-        "updateFailed": "No se pudo actualizar la delegación"
-      },
       "viewLogs": "Ver registros",
       "hideLogs": "Ocultar registros",
       "connectedAt": "Conectado · {baseUrl}",
@@ -1288,7 +1267,46 @@
       "backend": {
         "selectorLabel": "Backend de ejecución",
         "manifest": "Pool autohospedado (manifiesto)",
-        "kubernetes": "Kubernetes"
+        "kubernetes": "Kubernetes",
+        "environmentSelectorLabel": "Backend de entorno",
+        "environmentManifest": "API HTTP personalizada (manifiesto)"
+      },
+      "kubernetesEnv": {
+        "label": "Nombre",
+        "labelPlaceholder": "Clúster de vista previa",
+        "apiServerUrl": "URL del API server",
+        "apiServerUrlHelp": "La raíz del kube-apiserver, p. ej. https://10.0.0.1:6443. El orquestador aplica los manifiestos de cada PR a través del apiserver, así que solo este endpoint debe ser accesible.",
+        "apiToken": "Token de ServiceAccount",
+        "apiTokenHelp": "Un token bearer con permisos RBAC para crear namespaces y aplicar los recursos del operador. Se almacena cifrado; no se vuelve a mostrar.",
+        "manifestSourceLabel": "Origen de los manifiestos",
+        "sourceColocated": "En el mismo repo de la PR",
+        "sourceSeparate": "Repo aparte",
+        "repo": "Repo de manifiestos",
+        "repoHelp": "El owner/repo que contiene los manifiestos de Kubernetes, p. ej. acme/preview-manifests.",
+        "ref": "Ref",
+        "refHelp": "Rama, etiqueta o SHA donde leer los manifiestos. Vacío usa la rama por defecto del repo.",
+        "path": "Ruta del manifiesto",
+        "pathHelp": "Archivo o directorio dentro del repo que contiene los recursos a aplicar.",
+        "urlSourceLabel": "URL del entorno",
+        "urlIngressTemplate": "Plantilla de host del Ingress",
+        "urlIngressStatus": "Leer estado del Ingress",
+        "urlServiceStatus": "Leer estado del Service",
+        "hostTemplate": "Plantilla de host",
+        "hostTemplateHelp": "Plantilla de host renderizada con las variables de aprovisionamiento como branch y pullNumber; el host resultante se convierte en la URL del entorno.",
+        "ingressName": "Nombre del Ingress",
+        "ingressNameHelp": "Ingress del que leer el host del balanceador. Vacío usa el único Ingress aplicado.",
+        "serviceName": "Nombre del Service",
+        "port": "Puerto",
+        "scheme": "Esquema de URL",
+        "schemeDefault": "https (por defecto)",
+        "namespaceTemplate": "Plantilla de namespace",
+        "namespaceTemplateHelp": "Nombre del namespace por PR renderizado con las variables de aprovisionamiento como pullNumber. Vacío deriva uno del número de la PR.",
+        "imageTemplate": "Plantilla de imagen",
+        "imageTemplateHelp": "Referencia de imagen expuesta a los manifiestos, renderizada con las variables de aprovisionamiento como branch y sha.",
+        "caCertPem": "Certificado CA del clúster (PEM)",
+        "caCertPemHelp": "Pega el bundle CA del clúster para que el certificado TLS del apiserver se verifique. Omítelo solo para una CA de confianza pública.",
+        "insecureSkipTlsVerify": "Omitir verificación TLS",
+        "insecureSkipTlsVerifyHelp": "Muy desaconsejado. Desactiva la verificación TLS del apiserver; úsalo solo para clústeres kind/dev."
       },
       "kubernetes": {
         "label": "Nombre",
@@ -1304,6 +1322,10 @@
         "caCertPem": "Certificado CA del clúster (PEM)",
         "caCertPemHelp": "Pega el bundle CA del clúster para que el certificado TLS del apiserver se verifique. Omítelo solo para una CA de confianza pública.",
         "harnessPort": "Puerto del harness"
+      },
+      "advancedManifest": {
+        "summary": "Avanzado: planificador personalizado basado en API",
+        "intro": "Solo es necesario para integrar un planificador personalizado basado en API. Los backends habituales (Docker local, Cloudflare Containers y Kubernetes) no lo necesitan; describe aquí la API HTTP de tu propio planificador solo si usas uno."
       }
     },
     "serviceFragmentDefaults": {
@@ -1654,6 +1676,22 @@
         "removed": "Runner eliminado",
         "removeFailed": "No se pudo eliminar el runner"
       }
+    },
+    "infrastructure": {
+      "active": "Activo: {backend}",
+      "registerHint": "Registra un pool de ejecutores abajo para habilitarlo.",
+      "updateFailed": "No se pudo actualizar el backend de ejecución",
+      "executionBackend": {
+        "label": "Dónde se ejecutan los agentes",
+        "local-docker": "Docker local (host)",
+        "cloudflare-containers": "Cloudflare Containers (integrado)",
+        "runner-pool": "Pool de ejecutores autoalojado"
+      },
+      "testEnvBackend": {
+        "label": "Dónde se ejecutan los entornos de prueba",
+        "local-compose": "docker-compose en contenedor",
+        "environment-provider": "Proveedor de entornos"
+      }
     }
   },
   "providers": {